CVE-2023-42457
2 advisories.
PyPI/plone-rest CVE-2023-42457: high 7.5
plone.rest vulnerable to Denial of Service when ++api++ is used many times
Action: Upgrade plone-rest to 2.0.1 or later.
pip install plone-rest==2.0.1pip install plone-rest==3.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0a1 | 2.0.1 | - |
| 3.0.0 | 3.0.1 | - |
Fixed versions
| 2.0.1 | 3.0.1 |
Sources
- osv: GHSA-h6rp-mprm-xgcq
- https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
- https://nvd.nist.gov/vuln/detail/CVE-2023-42457
- https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
- https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
- https://github.com/plone/plone.rest
- https://github.com/pypa/advisory-database/tree/main/vulns/plone-rest/PYSEC-2023-178.yaml
- http://www.openwall.com/lists/oss-security/2023/09/22/2
CVE-2023-42457 · published · modified · JSON
PyPI/plone-rest CVE-2023-42457: high 7.5
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2023-178
- https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
- https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
- https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
- http://www.openwall.com/lists/oss-security/2023/09/22/2
CVE-2023-42457 · published · modified · JSON